This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 5cf98afb247540d131110359fa59ceb281fcbe2a Author: Mark Thomas <[email protected]> AuthorDate: Wed Nov 4 10:49:30 2026 +0000 Review "Validate the protocol of OCSP URLs from a client certificate..." Simplify code. Improve comment. --- .../apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java index ca55e4fc62..522a107385 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java @@ -1289,12 +1289,10 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn URL url = (new URI(urlString)).toURL(); String protocol = url.getProtocol(); if (!"http".equals(protocol) && !"https".equals(protocol)) { - // OpenSSLEngine can only talk HTTP/HTTPS to OCSP responders. Other - // protocol handlers (e.g. file) trigger a ClassCastException below so - // treat them as invalid and skip to the next URL, as the JNI - // implementation does when OCSP URL parsing fails. - log.warn(sm.getString("engine.invalidOCSPURL", urlString)); - continue; + // Only HTTP and HTTPS are supported for OCSP responders. Treat any + // other protocol as an invalid URL, as the JNI implementation does + // when OCSP URL parsing fails. + throw new MalformedURLException(urlString); } requestAttempted = true; ocspResponse = --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
